CVE-2026-66666mediumCWE-201

CVE-2026-66666: fallo de gravedad media en Automattic WordPress

WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability

Publicada el

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.9epss 0.3%
probabilidad de explotación
0.3%top 80% de las CVE
explotación observada
noninguna fuente lo reporta
Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
Automattic · WordPress
CVEs relacionadas — Automattic WordPress

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-32111MEDIUMWordPress core < 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerabilityEPSS 0.5%CVE-2026-93485HIGHWordPress core <= 7.1 - Unauth. Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-31111MEDIUMWordPress Core < 6.5.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%
Referencias
https://patchstack.com/articles/wordpress-7-1-3-security-release?_s_id=cvehttps://patchstack.com/database/wordpress/wordpress/wordpress/vulnerability/wordpress-wordpress-wordpress-7-1-2-sensitive-data-exposure-vulnerability?_s_id=cvehttps://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/